Method, system and equipment for dynamically restoring attack chain in threat analysis and medium

Abstract

The invention discloses a method, a system and equipment for dynamically restoring an attack chain in threat analysis and a medium. The method comprises the following steps: acquiring multi-source evidence data; processing the acquired data by combining a first curing technology with a second curing technology, generating a hash chain based on a timestamp, and calculating a root hash value; based on the processed data, carrying out digital signature on the Hash chain by adopting an asymmetric encryption technology; constructing and improving a Bayesian network model based on the digital signed Hash chain, and obtaining a key evidence node by fusing a time factor and a dynamic weight; based on the key evidence nodes, a visualization engine is used for generating an attack path graph and verifying the attack chain, accurate restoration of the attack chain and key evidence positioning are achieved, and accurate restoration of the attack chain, key evidence positioning and overall process credible guarantee are achieved; and the efficiency of network security event response and the compliance of judicial evidence collection are obviously improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, device and medium for dynamically restoring an attack chain in threat analysis. Background Art

[0002] As cyberattack techniques become increasingly complex and covert, kill chain restoration within threat analysis has become a core component of cybersecurity defense. Kill chain restoration aims to construct a complete sequence of attack behaviors by analyzing the attacker's intrusion steps (such as reconnaissance, penetration, and lateral movement), thereby tracing the attack source and formulating defense strategies. However, existing technologies suffer from the following issues:

[0003] 1. Evidence is easily tampered with or lost: Traditional forensic technology cannot guarantee the integrity of key evidence in the attack chain;

[0004] 2. Weak dynamic behavior correlation: The causal relationship between attack steps is often difficult to model due to fragmented evidence;

[0005] 3. Insufficient fusion of multi-source data: The heterogeneity of multi-dimensional data such as network traffic, host logs, and memory snapshots makes correlation analysis difficult.

[0006] Therefore, there is an urgent need for an innovative technology that can solidify key evidence and dynamically restore the attack chain. Summary of the Invention

[0007] In view of the above existing problems, the present invention is proposed.

[0008] Therefore, the present invention provides a method, system, device and medium for dynamic restoration of attack chains in threat analysis to solve the problems of existing technologies such as easy tampering or loss of evidence, weak dynamic behavior correlation and insufficient multi-source data fusion.

[0009] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0010] In a first aspect, the present invention provides a method for dynamically restoring an attack chain in threat analysis, comprising:

[0011] Acquire multi-source evidence data;

[0012] The acquired data is processed by combining the first solidification technology with the second solidification technology to generate a timestamp-based hash chain and calculate the root hash value;

[0013] Based on the processed data, the hash chain is digitally signed using asymmetric encryption technology;

[0014] Based on the digitally signed hash chain, we build and improve the Bayesian network model, and obtain key evidence nodes by integrating time factors and dynamic weights.

[0015] Based on key evidence nodes, a visualization engine is used to generate an attack path diagram and verify the attack chain, achieving accurate restoration of the attack chain and positioning of key evidence.

[0016] As a preferred solution of the attack chain dynamic restoration method in threat analysis of the present invention, wherein: the first solidification technology combined with the second solidification technology includes:

[0017] Apply a specific hash function to each piece of evidence data to generate a corresponding hash value;

[0018] Connect the hash values of all evidence data in chronological order to build a timestamp-based hash chain;

[0019] Group the hash values in the hash chain as leaf nodes of the hash binary tree structure;

[0020] Calculate the hash values of non-leaf nodes layer by layer until the root hash value is obtained.

[0021] As a preferred solution of the method for dynamically restoring the attack chain in threat analysis of the present invention, the method of digitally signing the hash chain using asymmetric encryption technology includes:

[0022] Get the original hash chain, root hash value and digital signature;

[0023] Decrypt the digital signature using the signer's public key to obtain the decrypted hash value;

[0024] Recalculate each hash value in the hash chain based on the original evidence data until the root hash value is generated;

[0025] Compare the decrypted hash value with the recalculated root hash value;

[0026] If the decrypted hash value is consistent with the recalculated root hash value, the current evidence has not been tampered with and the signature is valid.

[0027] The beneficial effect of this preferred technical solution is that it uses asymmetric encryption to digitally sign the hash chain, meeting the requirements of judicial evidence collection of electronic evidence and ensuring the traceability and non-repudiation of the source of evidence.

[0028] As a preferred solution of the attack chain dynamic restoration method in threat analysis of the present invention, the construction and optimization of the Bayesian network model includes:

[0029] Determine the attack step nodes based on historical data and known attack patterns;

[0030] Based on historical data, calculate the prior probability of each attack step occurring;

[0031] Mapping multi-source evidence data as observation variables into a directed acyclic graph to construct a Bayesian network model;

[0032] Improve the Bayesian network model through time series variables and dynamically update the posterior probability;

[0033] Use the time decay factor and sliding window mechanism to dynamically adjust the weight of evidence, conduct correlation analysis on the evidence, and obtain key evidence nodes.

[0034] The beneficial effect of this preferred technical solution is that, by constructing and optimizing the Bayesian network model, it can more accurately characterize the time dependency between attack steps and evidence, improve the detection capability of advanced persistent threats, and adapt to the dynamic network attack environment.

[0035] As a preferred solution of the method for dynamically restoring the attack chain in threat analysis of the present invention, the method of generating the attack path diagram using a visualization engine includes:

[0036] The attack steps are represented as nodes, and the directed edges between nodes represent the logical order of the attack;

[0037] Mark key evidence nodes;

[0038] The posterior probability is labeled as the confidence level.

[0039] As a preferred solution of the method for dynamically restoring the attack chain in threat analysis of the present invention, the verification of the attack chain includes:

[0040] Define the number of simulations;

[0041] Based on the obtained prior probability and the real-time updated posterior probability, each attack step in the attack chain is randomly sampled to simulate the attack process;

[0042] Based on random sampling to simulate the attack process, the frequency of different attack chain development scenarios is counted;

[0043] If the attack steps and evidence appearing in the simulation match the corresponding steps and evidence in the actual constructed attack chain, it indicates that the attack chain restoration process is correct.

[0044] As a preferred solution of the attack chain dynamic restoration method in threat analysis of the present invention, the dynamically updated posterior probability is expressed as:

[0045]

[0046] Among them, S j Indicates the target attack step currently being evaluated, S krepresents the kth step among all possible attack steps, T represents the time series variable, P(S j |T) represents the target attack step S given the time series T. j Probability of occurrence, P(E|S j ) indicates that in the target attack step S j The probability of evidence E appearing in the event of Represents all possible attack steps S k To sum, P(E|S k ) represents the number of possible attack steps S k The probability of observing evidence E when the occurrence of k |T) represents all possible attack steps S given the time series variable T. k Prior probability of occurrence.

[0047] In a second aspect, the present invention provides a system for dynamically restoring attack chains in threat analysis, comprising:

[0048] An acquisition module, used to obtain multi-source evidence data;

[0049] An evidence solidification module, configured to process the acquired data by combining the first solidification technology with the second solidification technology, generate a timestamp-based hash chain, and calculate a root hash value;

[0050] Evidence signature module, used to digitally sign the hash chain based on the processed data using asymmetric encryption technology;

[0051] The Bayesian network analysis module is used to build and improve the Bayesian network model based on the digitally signed hash chain, and obtain key evidence nodes by integrating time factors and dynamic weights;

[0052] The visualization and verification module is used to generate an attack path diagram based on key evidence nodes using a visualization engine and verify the attack chain, thereby achieving accurate restoration of the attack chain and locating key evidence.

[0053] In a third aspect, the present invention provides an electronic device, comprising:

[0054] Memory, used to store programs;

[0055] The processor is configured to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the attack chain dynamic restoration method in the threat analysis.

[0056] In a fourth aspect, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, the steps of implementing the method for dynamically restoring the attack chain in the threat analysis are implemented.

[0057] The beneficial effects of the present invention are as follows: the present invention uses a technical solution of a hash chain construction and verification mechanism based on a timestamp to link the hash values of each piece of evidence data in chronological order and organize them into a hierarchical hash tree structure, thereby ensuring the chronological order, integrity and non-tamperability of all evidence data and improving the credibility and legal effectiveness of evidence; the generated hash chain is signed and authenticated to ensure the authenticity of the source of evidence and the non-repudiation of the signer; through a temporal Bayesian network modeling and improved reasoning technical solution, time series variables and a dynamic weight mechanism are introduced to integrate prior knowledge and real-time evidence, helping to identify the key links and potential risks of the attack chain, and ultimately achieving accurate restoration of the attack chain, positioning of key evidence and trustworthy assurance of the entire process, significantly improving the efficiency of network security incident response and the compliance of judicial evidence collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort. Among them:

[0059] Figure 1 A schematic diagram of the basic flow of a method for dynamically restoring an attack chain in threat analysis provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0060] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0061] Example 1, reference Figure 1 , as one embodiment of the present invention, provides a method for dynamically restoring an attack chain in threat analysis, comprising:

[0062] S100: Acquire multi-source evidence data;

[0063] S200: Processing the acquired data using the first solidification technology combined with the second solidification technology to generate a timestamp-based hash chain and calculate a root hash value;

[0064] S300: Based on the processed data, asymmetric encryption technology is used to digitally sign the hash chain;

[0065] S400: Based on the digitally signed hash chain, a Bayesian network model is constructed and improved to obtain key evidence nodes by integrating time factors and dynamic weights;

[0066] S500: Based on key evidence nodes, a visualization engine is used to generate an attack path diagram and verify the attack chain, achieving accurate restoration of the attack chain and locating key evidence.

[0067] It should be noted that in the field of cybersecurity, the complexity of multi-source, heterogeneous data makes it difficult to extract useful information. The time sensitivity and integrity protection of evidence require that each piece of evidence not only accurately reflect the chronological order of attack behavior but also be tamper-resistant to ensure its credibility. The uncertainty inherent in dynamic attack environments increases the need for real-time updates of attack step probabilities, making traditional static analysis methods difficult to adapt to rapidly changing attack patterns. Faced with these challenges, research on the dynamic restoration of attack chains is particularly important.

[0068] Therefore, to address the aforementioned issues with existing technologies, such as the susceptibility of evidence to tampering or loss, weak dynamic behavior correlation, and insufficient multi-source data fusion, steps S100-S500 are used to accurately characterize the temporal dependencies of attack behaviors by introducing time series variables and a dynamic weighting mechanism. Furthermore, Bayesian network models combined with visualization technology enable efficient identification and intuitive display of attack paths, greatly improving understanding and response speed to complex attack behaviors, providing strong decision-making support for security analysts, and effectively enhancing overall network security defense capabilities. Therefore, dynamic restoration of attack chains has irreplaceable strategic significance for improving threat detection accuracy, shortening emergency response time, and ensuring the security of critical information systems.

[0069] Example 2 is an embodiment of the present invention, which provides a method for dynamically restoring an attack chain in threat analysis based on the previous embodiment, including:

[0070] In the embodiment of the present application, the multi-source evidence data obtained in step S100 includes network traffic (NetFlow), host process snapshots, system logs (Syslog), and memory images;

[0071] In the embodiments of this application, network traffic (NetFlow) contains rich information such as the source address, destination address, port number, flow rate, and time sequence of network data packets. This data can reflect the basic status of network communications and is an important basis for tracking attackers' network activity paths and behavior patterns. For example, by analyzing NetFlow data, suspicious signs such as abnormal traffic surges and frequent communications between specific IP addresses can be discovered, which may be early signs of attack behavior.

[0072] In the embodiments of the present application, the host process snapshot records the detailed status of each process at a specific moment during system operation, including information such as the process name, ID, system resources occupied, open files, and network connections. When the system is attacked, the abnormal activity of the malicious process often leaves traces in the host process snapshot, such as the appearance of a process with unknown origin and high permissions, or a process abnormally occupying a large amount of system resources in a short period of time. This information is crucial for determining the specific operation and impact of the attack behavior within the host.

[0073] In the embodiments of this application, the system log (Syslog) is a record of various events generated during system operation, covering a variety of information such as system startup, user login, system errors, and permission changes. These logs record various system operations in detail in chronological order, and can provide key event clues on the timeline for restoring the attack chain. For example, by analyzing the login failure records in the system log, it is possible to detect the attacker's attempt to brute force the user's password; and the system error log may reveal traces of the attacker exploiting system vulnerabilities to launch an attack.

[0074] In the embodiments of this application, a memory mirror is a complete copy of the state of computer memory at a specific moment. It stores the program code, data, system kernel information, and other content currently running in memory. When an attack occurs, critical evidence may be stored in memory that has not yet been written to disk, such as the malware's memory-resident modules, encryption keys, and temporary data generated during the attack. By analyzing the memory mirror, it is possible to obtain this important information, which is difficult to store on disk or easily tampered with, providing strong support for in-depth analysis of the attack chain.

[0075] In the embodiment of the present application, step S200 combines the first curing technology with the second curing technology, including:

[0076] Apply a specific hash function to each piece of evidence data to generate a corresponding hash value;

[0077] Connect the hash values of all evidence data in chronological order to build a timestamp-based hash chain;

[0078] Group the hash values in the hash chain as leaf nodes of the hash binary tree structure;

[0079] Calculate the hash values of non-leaf nodes layer by layer until the root hash value is obtained.

[0080] In an optional embodiment, the first solidification technology in step S200 may be a hash chain solidification technology, or a blockchain technology; or a timestamp service;

[0081] In an optional implementation, the hash chain solidification technology generates a timestamp-based hash chain for multi-source evidence data to ensure the temporal sequence and integrity of the evidence and provide an unalterable chain of evidence.

[0082] In an optional implementation, blockchain technology records key evidence information through a distributed ledger, leveraging its decentralized and tamper-proof characteristics to enhance the credibility of evidence and multi-party collaborative verification capabilities.

[0083] In an optional implementation, the timestamp service provides authoritative time authentication for each piece of evidence or hash chain node, ensuring the temporal accuracy and legal validity of the evidence and enhancing the credibility of the evidence in judicial evidence collection.

[0084] It should be noted that while blockchain technology offers enhanced tamper resistance and a multi-party collaborative verification mechanism, its complex consensus algorithm and high resource consumption may not be suitable for all application scenarios, especially real-time systems with high performance and efficiency requirements. While timestamp services can provide authoritative time authentication for individual pieces of evidence, they lack overall relevance and continuity protection when processing large amounts of evidence data. Therefore, hash chain curation technology, with its simplicity and efficiency, is more suitable for building large-scale, dynamically changing attack chain analysis systems while ensuring the credibility of evidence. In comparison, the hash chain curation technology used in this invention offers significant advantages over blockchain technology and timestamp services.

[0085] In the embodiment of this application, the hash chain solidification technology is used to solidify evidence. The core of this technology is to generate a hash value for the collected raw data and build a hash chain based on the timestamp. The specific formula is:

[0086] H i =Hash(H i-1 ||D i ||T i )

[0087] In this formula, H i Represents the currently generated hash value, which is based on the previous hash value H i-1 , the i-th evidence data D i And the corresponding timestamp T i , calculated using a specific hash function. These hash functions (such as the commonly used SHA-256) are one-way and highly sensitive, meaning any slight change in the input data will result in a significant difference in the output hash value. In this way, each piece of evidence is tightly linked to previous evidence and time information, forming an unalterable chain.

[0088] In an optional implementation, the second solidification technology in step S200 may be a Merkle tree structure, a single-layer hash summary technology, or a chain hash structure.

[0089] In an optional implementation, the Merkle tree structure achieves hierarchical aggregation and integrity verification of multi-source evidence data by constructing a multi-level Merkle tree structure, ensuring that any tampering of the underlying data can be reflected step by step to the root hash, thereby providing an efficient and reliable multi-level evidence solidification mechanism.

[0090] In an optional implementation, single-layer hash summary technology provides a basic level of overall integrity verification by generating a unified hash value for all evidence data, but lacks fine-grained verification and time series support.

[0091] In an optional implementation, the chained hash structure links the evidence in sequence according to the order of collection to form a time-continuous hash chain, which supports time sequence protection and incremental updates to a certain extent.

[0092] It should be noted that single-layer hash summary technology can only perform a single hash check on the entire data, lacking local verification and time series binding capabilities. Once tampering is discovered, it is impossible to accurately locate the tampering point. While the chained hash structure introduces a timestamp and contextual association mechanism, its linear structure limits it from supporting efficient parallel processing and local tamper tracking, and its scalability and flexibility are poor for large-scale data sets. Therefore, the Merkle tree structure, with its powerful anti-tampering capabilities, fine-grained verification, and efficient data management features, has become the best choice for ensuring the integrity and reliability of evidence in this invention.

[0093] It should be noted that this invention utilizes hash chain solidification technology combined with a Merkle tree structure to ensure the integrity of evidence. Any single point of tampering will cause the root hash value to change, making it easy to detect whether the evidence has been tampered with. Furthermore, the hash chain is digitally signed using asymmetric encryption (such as RSA), making the evidence legally binding and meeting judicial evidence collection requirements. This provides a solid basis for legal proceedings or security audits, enhancing the credibility and usability of the evidence.

[0094] In the embodiments of the present application, in order to further enhance the reliability and security of evidence solidification, the present invention combines the Merkle tree structure to achieve multi-level evidence solidification. The Merkle tree is a tree-like data structure in which each non-leaf node is the hash value of the contents of its two child nodes. In the present invention, the root hash value is calculated according to the following formula:

[0095] RootHash=Hash(H left ||H right ||T root )

[0096] Among them, H left and H right They are the hash values of the left and right subtrees in the Merkle tree, T root The advantage of this structure is that any single point of tampering with the underlying evidence data will cause the hash value of the subtree to change, and then pass it up layer by layer, eventually causing the root hash value to change. For example, suppose a certain underlying evidence data D i If it is tampered, then the H generated based on it i will change, which will result in the inclusion of H i The parent node hash value changes, and so on, until the root hash value also changes. In this way, the integrity of the entire evidence set can be effectively protected. Once the root hash value changes, it can be immediately determined that the evidence has been tampered with at some point.

[0097] In the embodiment of the present application, step S300 uses asymmetric encryption technology to digitally sign the hash chain, including:

[0098] Get the original hash chain, root hash value and digital signature;

[0099] Decrypt the digital signature using the signer's public key to obtain the decrypted hash value;

[0100] Recalculate each hash value in the hash chain based on the original evidence data until the root hash value is generated;

[0101] Compare the decrypted hash value with the recalculated root hash value;

[0102] If the decrypted hash value is consistent with the recalculated root hash value, the current evidence has not been tampered with and the signature is valid.

[0103] In an embodiment of the present application, after the hash chain is constructed, in order to ensure that the evidence has legal effect, the present invention uses asymmetric encryption technology (such as RSA) to digitally sign the hash chain. The RSA algorithm is based on the large integer decomposition problem in number theory and has the characteristics of a public-private key pair. During the signing process, the hash chain is encrypted with a private key to generate a digital signature. In the verification stage, anyone can use the corresponding public key to decrypt the digital signature and compare it with the original hash chain. Since the private key is only held by the signer, others cannot forge the signature, so this method ensures the traceability and non-repudiation of the source of the evidence. In legal proceedings or security audit scenarios, digitally signed evidence can serve as a strong legal basis and provide reliable support for judicial agencies or security investigators.

[0104] In the embodiment of the present application, step S400 constructs and optimizes the Bayesian network model, including:

[0105] Determine the attack step nodes based on historical data and known attack patterns;

[0106] Based on historical data, calculate the prior probability of each attack step occurring;

[0107] Mapping multi-source evidence data as observation variables into a directed acyclic graph to construct a Bayesian network model;

[0108] Improve the Bayesian network model through time series variables and dynamically update the posterior probability;

[0109] Use the time decay factor and sliding window mechanism to dynamically adjust the weight of evidence, conduct correlation analysis on the evidence, and obtain key evidence nodes.

[0110] In the embodiment of the present application, the Bayesian network, as a probabilistic graph model, can effectively handle uncertainty and causality. In the present invention, the attack steps are abstracted as nodes in the network, and the evidence obtained from various data sources (such as network traffic, host process snapshots, system logs, memory images, etc.) is used as observation variables, and they are mapped into a directed acyclic graph (DAG). In this directed acyclic graph, the directed edges between the nodes represent the causal relationship between the attack steps and between the attack steps and the evidence. For example, if a certain attack step "invading host A" is usually followed by the attack step "creating a new user on host A", then in the Bayesian network, the "invading host A" node will have a directed edge pointing to the "creating a new user on host A" node; at the same time, evidence related to "invading host A", such as specific network connection logs, abnormal login attempt records, etc., will also be associated with the node. This structure can intuitively show the logical order of the attack behavior and the dependency between the evidence and the attack steps, laying the foundation for subsequent probability calculation and analysis.

[0111] In the embodiment of the present application, in order to overcome the limitations of the traditional Bayesian network, this technology improves it and introduces a time series variable T to more accurately reflect the dynamic relationship between the attack steps and the evidence. The dynamically updated posterior probability is expressed as:

[0112]

[0113] Among them, T represents the time series variable, which contains the time when the evidence appears and the time when the attack steps occur. j |T) represents the target attack step S given the time series T. j Probability of occurrence, P(E|S j ) still indicates that in the target attack step Sj The probability of evidence E appearing when something happens. By introducing the time series variable T, the temporal dependency between attack steps and evidence can be more accurately characterized. For example, if a target attack step S j Usually occurs within a certain time period, and the related evidence E also appears within a similar time period, then when calculating P(S j |E,T), this time information will be taken into consideration, thereby improving the accuracy of judging the attack steps.

[0114] In the embodiment of the present application, the prior probability is trained based on historical attack data, which contains the attack steps and related evidence information of various attack scenarios that occurred in the past. By statistically analyzing a large amount of historical data, the attack step S of each target can be calculated. j The prior probability of occurrence P(S j ) and the probability of evidence appearing at different attack steps P(E|S j For example, by analyzing a large number of recorded network attack events, it is found that the probability of a certain type of attack (such as SQL injection attack) occurring in a specific network environment is P(S j ), and when this attack occurs, the probability of a specific database error log (as evidence E) is P(E|S j ). In the actual attack chain restoration process, new real-time evidence will continue to emerge. In order to enable the Bayesian network to reflect this new information in a timely manner, the posterior probability is dynamically updated based on the real-time evidence. When there is new evidence E new When it appears, the improved Bayesian network formula is used to recalculate the posterior probability P(S j |E new ,T). In this way, as new evidence is continuously added, the Bayesian network can continuously optimize the judgment of the attack steps and more accurately restore the development process of the attack chain.

[0115] In the embodiment of the present application, the timeliness of evidence is very important in the process of network attack. As time goes by, the relevance and importance of some early evidence to the current attack step will gradually decrease. In order to reflect this timeliness, a time decay factor λ(t) = e is introduced. -αt , where α is the decay coefficient and t represents the time interval from the generation of evidence to the current moment. This decay factor affects the weight of evidence in the probability calculation of attack steps. For example, for an evidence E that appears at the beginning of the attack, as time goes by, it will be j The probability P(S j|E,T) will gradually decrease according to the law of λ(t). By adjusting the decay coefficient α, the decay rate of evidence weight can be flexibly controlled according to different attack scenarios and evidence characteristics. In some scenarios where the attack changes rapidly, the value of α can be appropriately increased to make the weight of early evidence decay faster; in some scenarios where the attack process is relatively slow and the evidence relevance lasts for a long time, the value of α can be reduced.

[0116] In the embodiment of the present application, the sliding window mechanism in the real-time evidence consolidation algorithm is used to dynamically adjust the weight of evidence and realize the real-time management and reasonable use of evidence. The sliding window mechanism defines the window size W, and the formula is:

[0117] W(t)={E i |tT i ≤Δt max}

[0118] Among them, E i Indicates evidence, T i It is evidence E i The time of generation, t is the current moment, Δt max This formula indicates that at the current time t, the evidence contained in the sliding window W(t) is the evidence whose time difference between the generation time and the current time does not exceed the maximum tolerable delay Δt max For example, if Δt max If set to 1 hour, then at the current moment, only evidence generated within the past hour will be included in the sliding window W(t). This approach dynamically removes expired evidence, preventing interference with attack chain analysis caused by excessive use of expired evidence. Furthermore, the sliding window continuously moves over time, continuously incorporating new valid evidence. This ensures that the most relevant and valid evidence is always used during attack chain modeling and correlation analysis, thereby improving the accuracy and real-time nature of attack chain restoration.

[0119] It should be noted that building a Bayesian network and introducing time series variables to improve the model, combining historical data to train prior probabilities and dynamically updating posterior probabilities based on real-time evidence, can more accurately reveal the inherent connections between attack steps and evidence, improving the accuracy of attack chain reconstruction. The use of time decay factors and sliding window mechanisms can dynamically adjust evidence weights, promptly remove outdated evidence, adapt to dynamic changes in attack behavior, and enhance detection capabilities for complex attacks such as APT attacks, effectively addressing the increasing complexity and concealment of cyberattack techniques.

[0120] In the embodiments of this application, after completing the attack chain modeling and correlation analysis, in order to enable security analysts, decision makers, and other relevant personnel to more intuitively understand the overall picture and details of the attack, while ensuring the accuracy and reliability of the constructed attack chain, it is necessary to visualize and verify the attack chain. This step plays a key role in the entire attack chain restoration process, helping users quickly identify the key links and potential risks of the attack.

[0121] In the embodiment of the present application, step S500 uses a visualization engine to generate an attack path diagram, including:

[0122] The attack steps are represented as nodes, and the directed edges between nodes represent the logical order of the attack;

[0123] Mark key evidence nodes;

[0124] The posterior probability is labeled as the confidence level.

[0125] In the embodiment of the present application, the visualization engine is the core tool for realizing the visualization of the attack chain, which can convert the Bayesian network model constructed by the previous steps and the related attack steps, evidence information, etc. into an intuitive graphical representation. Common visualization engines have powerful graphics rendering capabilities and interactive functions, and can automatically draw an attack path diagram based on the causal relationship and time sequence between the attack steps. In the attack path diagram, the attack steps are represented as nodes, and these nodes are connected by directed edges to show the logical order of the attack behavior. For example, starting from the "initial access" node, there may be a directed edge pointing to the "execute malicious code" node, and then from the "execute malicious code" node to the "lateral movement" node, and so on, clearly presenting the process of the attack from the beginning to the gradual development.

[0126] In the embodiments of this application, to make the attack path diagram more informative and valuable, key evidence nodes and confidence levels are annotated in the diagram. Key evidence nodes are those pieces of evidence that provide important support for determining the occurrence of an attack step. For example, when determining the attack step "Execute malicious code," abnormal process startup information recorded in the system log, data packets communicating with the malicious code appearing in network traffic, and so on can all be displayed as key evidence nodes in the diagram. Confidence levels are a quantitative representation of the likelihood of an attack step occurring. In the previous attack chain modeling and association analysis, the posterior probability of each attack step was calculated using an improved Bayesian network model. These probabilities can be annotated as confidence levels on the corresponding nodes in the attack path diagram. For example, the node "Execute malicious code" might be labeled "Confidence: 80%," indicating that based on the current evidence and model, the probability of this attack step occurring is 80%. By annotating confidence levels, users can quickly assess the credibility of each attack step, focusing more on key attack links with higher confidence levels.

[0127] It should be noted that visualizing attack chains offers numerous advantages. For security analysts, by observing the attack path diagram, they can quickly locate the attack's starting point, key steps, and potential impact, allowing for more targeted, in-depth analysis and investigation. For decision-makers, intuitive attack chain diagrams help them quickly understand the severity and potential risks of an attack, enabling them to make timely decisions and implement appropriate preventative and countermeasures. Furthermore, visual attack chain diagrams facilitate communication and collaboration across departments, promoting information sharing and exchange.

[0128] In the embodiment of the present application, the attack chain is verified in step S500, including:

[0129] Define the number of simulations;

[0130] Based on the obtained prior probability and the real-time updated posterior probability, each attack step in the attack chain is randomly sampled to simulate the attack process;

[0131] Based on random sampling to simulate the attack process, the frequency of different attack chain development scenarios is counted;

[0132] If the attack steps and evidence presented in the simulation match the corresponding steps and evidence in the actual attack chain, the attack chain restoration process ends. This is verified through Monte Carlo simulation.

[0133] In the embodiments of the present application, Monte Carlo simulation is a numerical simulation method based on probability statistics that plays an important role in attack chain verification. This method evaluates the rationality and reliability of the attack chain through a large number of random sampling and simulation calculations. Specifically, during the Monte Carlo simulation process, each attack step in the attack chain is randomly sampled based on the prior probability trained in the previous steps and the posterior probability updated in real time. For example, for each attack step, a random number generator is used to determine whether the step will occur based on its probability of occurrence. Then, the entire attack process is simulated to observe whether the results can match the actual evidence collected. In each simulation, the development of the attack chain and the final results are recorded. After a large number of simulations (for example, thousands or even tens of thousands of simulations), the frequency of occurrence of various attack chain development scenarios is statistically calculated. If the simulation results show that the attack chain obtained in most cases is similar to the actual attack chain constructed and can reasonably explain the collected evidence, then it means that the actual attack chain constructed is highly reasonable and reliable; conversely, if the simulation results are significantly different from the actual attack chain, or cannot explain the evidence, then the attack chain needs to be adjusted and optimized.

[0134] In the embodiment of the present application, the generated attack path diagram is verified from different angles to ensure its accuracy and reliability;

[0135] In the embodiment of the present application, the verification of the attack chain also includes counterfactual verification. Counterfactual verification is an important verification method. It assumes that a key link in the attack chain did not occur, and then analyzes whether other evidence and attack steps are still reasonable in this case. For example, assuming that the attack step of "initial access" did not occur, can the evidence relied on by subsequent attack steps such as "execution of malicious code" and "lateral movement" still be reasonably explained? If other evidence and attack steps cannot be justified under the assumption that a certain attack step did not occur, then it means that the attack step is necessary in the attack chain and the construction of the attack chain is reasonable; conversely, if even if a key attack step does not occur, the other parts can still reasonably exist, then it is necessary to re-examine the construction of the attack chain to check whether there are errors or unreasonable associations.

[0136] In the embodiments of this application, by combining counterfactual verification and Monte Carlo simulation, the attack chain can be comprehensively verified from different perspectives, ensuring its accuracy and reliability. An accurate attack chain can provide a solid foundation for subsequent security response and preventive measures, helping enterprises and organizations to promptly detect and prevent potential attacks and reduce security risks. Furthermore, a reliable attack chain verification process can enhance user trust in the analysis results and improve the scientific nature and effectiveness of decision-making.

[0137] Example 3 is an embodiment of the present invention. This embodiment provides a deep brain stimulation surgery and treatment auxiliary method and system based on digital twin technology. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through specific implementation methods and implementation effects.

[0138] The specific details of this embodiment are as follows:

[0139] In an enterprise network environment, the company operates multiple business systems that store and process sensitive customer data. Recently, the company discovered signs of unusual access to some customer data, suspecting a cyberattack. The company then activated this technology to restore and analyze the attack chain.

[0140] Step 1: Evidence collection and solidification

[0141] Use network traffic collection tools to continuously collect network traffic (NetFlow) data, obtain host process snapshots every 5 minutes, record system logs (Syslog) in real time, and generate memory images immediately after discovering anomalies.

[0142] The collected raw data is processed according to the hash chain solidification technology. For example, at a certain moment, network traffic data D1, the corresponding timestamp T1, and the previous hash value H0 (the initial value can be set to a fixed value) are collected. According to the formula H i =Hash(H i-1 ||D i ||T i ) calculate H1. As data is continuously collected, H2, H3, etc. are generated in sequence to build a hash chain. At the same time, combined with the Merkle tree structure, the hash values in the hash chain are grouped as leaf nodes of the Merkle tree, and the parent node hash value is calculated, and finally the root hash value RootHash=Hash(H left ||H right ||T root ) to ensure the integrity of the evidence. After the hash chain is built, the hash chain is digitally signed using the RSA algorithm to ensure that the evidence has legal effect.

[0143] Step 2: Attack Chain Modeling and Correlation Analysis

[0144] 1) Building a Bayesian network

[0145] Based on historical experience and known attack patterns, attack step nodes are identified, such as "scanning network vulnerabilities," "exploiting vulnerabilities to invade," and "stealing data." The various types of collected evidence are used as observation variables and mapped into a directed acyclic graph (DAG) to establish a causal relationship between attack steps and evidence. For example, a large number of scan requests targeting specific ports in network traffic is used as evidence and associated with the "scanning network vulnerabilities" node; abnormal privilege escalation events recorded in system logs are associated with the "exploiting vulnerabilities to invade" node.

[0146] 2) Calculate conditional probability

[0147] The improved Bayesian network model is used to calculate the conditional probability. First, based on the historical data of the enterprise’s past attacks, the prior probability is trained, such as P(S j )(Target attack step S j Prior probability of occurrence) and P(E|S j )(In target attack step S j After discovering abnormal data access, new real-time evidence is constantly generated. For example, if a specific IP address is found to have frequently attempted to log in to the database server in a short period of time, it will be used as new evidence E. new According to the improved formula Combined with the time series variable T (such as the time when evidence is generated and the time when the attack steps may occur), the posterior probability is dynamically updated.

[0148] 3) Introducing time decay factor and sliding window mechanism

[0149] Set the time decay factor λ(t) = e -αt , where the attenuation coefficient α is set to 0.1 based on the characteristics of enterprise network attacks. As time goes by, the weight of early evidence on the probability calculation of the current attack step gradually decreases. At the same time, a sliding window mechanism is used to set the maximum tolerable delay Δt max For example, at a certain time t, the sliding window W(t) = {E i |tT i ≤1 hour}, only valid evidence within the window is retained for attack chain analysis, and expired evidence is dynamically removed to ensure the accuracy and real-time nature of the analysis.

[0150] Step 3: Attack Chain Visualization and Verification

[0151] 1) Attack chain visualization

[0152] Using a professional visualization engine, an attack path diagram is generated. The diagram presents attack steps as nodes, with directed edges between nodes representing the attack's logical sequence. Key evidence nodes, such as unusual scanning requests in network traffic and unusual login records in system logs, are annotated, and the confidence level is indicated next to the node. For example, the confidence level for the "Exploiting a vulnerability" node is 75%, visually demonstrating the entire attack chain and the credibility of each link.

[0153] 2) Attack chain verification

[0154] Using counterfactual verification, we hypothesized that the "network vulnerability scanning" attack step had not occurred and analyzed the subsequent evidence and attack steps to determine if they were reasonable. We found that without the scanning behavior, the subsequent evidence, including abnormal logins and data access anomalies, could not be reasonably explained, indicating that this step was necessary in the attack chain.

[0155] We also conducted Monte Carlo simulations for validation. We set the number of simulations to 10,000, randomly sampling the attack process based on the probability of each attack step. After numerous simulations, we found that the majority of simulation results were similar to the actual attack chain constructed and reasonably matched the collected evidence, demonstrating the high accuracy and reliability of the constructed attack chain.

[0156] Through the implementation of this technology, we successfully reconstructed the attack chain, determining that the attackers first scanned for network vulnerabilities, exploited the discovered vulnerabilities, and then breached the system, stealing sensitive data. Based on the analysis results, the company took timely measures to fix the vulnerabilities and strengthen access controls, effectively preventing further data leakage risks.

[0157] Example 4 is an embodiment of the present invention. This embodiment is different from the first embodiment in that it provides a system for dynamically restoring attack chains in threat analysis.

[0158] It should be noted that the technical solution of the attack chain dynamic restoration system in threat analysis and the technical solution of the attack chain dynamic restoration method in threat analysis mentioned above belong to the same concept. For details not described in detail in the technical solution of the attack chain dynamic restoration system in threat analysis in this embodiment, please refer to the description of the technical solution of the attack chain dynamic restoration method in threat analysis mentioned above.

[0159] In this embodiment, a system for dynamically restoring an attack chain in threat analysis includes:

[0160] An acquisition module, used to acquire multi-source evidence data;

[0161] An evidence solidification module, configured to process the acquired data by combining the first solidification technology with the second solidification technology, generate a timestamp-based hash chain, and calculate a root hash value;

[0162] Evidence signature module, used to digitally sign the hash chain based on the processed data using asymmetric encryption technology;

[0163] The Bayesian network analysis module is used to build and improve the Bayesian network model based on the digitally signed hash chain, and obtain key evidence nodes by integrating time factors and dynamic weights;

[0164] The visualization and verification module is used to generate an attack path diagram based on key evidence nodes using a visualization engine and verify the attack chain, thereby achieving accurate restoration of the attack chain and locating key evidence.

[0165] This embodiment further provides an electronic device applicable to a method for dynamically restoring an attack chain in threat analysis, including:

[0166] Memory and processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement a method for dynamically restoring an attack chain in threat analysis as proposed in the above embodiment.

[0167] This embodiment further provides a storage medium having a computer program stored thereon. When the program is executed by a processor, the method for dynamically restoring an attack chain in threat analysis proposed in the above embodiment is implemented.

[0168] The storage medium proposed in this embodiment and the method for dynamically restoring an attack chain in threat analysis proposed in the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0169] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as a computer's floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0170] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for dynamically restoring an attack chain in threat analysis, characterized in that: include: Acquire multi-source evidence data; The acquired data is processed by combining the first solidification technology with the second solidification technology to generate a timestamp-based hash chain and calculate the root hash value; Based on the processed data, the hash chain is digitally signed using asymmetric encryption technology; Based on the digitally signed hash chain, we build and improve the Bayesian network model, and obtain key evidence nodes by integrating time factors and dynamic weights. Based on key evidence nodes, a visualization engine is used to generate an attack path diagram and verify the attack chain, achieving accurate restoration of the attack chain and positioning of key evidence.

2. The method for dynamically restoring an attack chain in threat analysis according to claim 1, wherein: The method of combining the first curing technology with the second curing technology includes: Apply a specific hash function to each piece of evidence data to generate a corresponding hash value; Connect the hash values of all evidence data in chronological order to build a timestamp-based hash chain; Group the hash values in the hash chain as leaf nodes of the hash binary tree structure; Calculate the hash values of non-leaf nodes layer by layer until the root hash value is obtained.

3. The method for dynamically restoring an attack chain in threat analysis according to claim 1 or 2, characterized in that: The use of asymmetric encryption technology to digitally sign the hash chain includes: Get the original hash chain, root hash value and digital signature; Decrypt the digital signature using the signer's public key to obtain the decrypted hash value; Recalculate each hash value in the hash chain based on the original evidence data until the root hash value is generated; Compare the decrypted hash value with the recalculated root hash value; If the decrypted hash value is consistent with the recalculated root hash value, the current evidence has not been tampered with and the signature is valid.

4. The method for dynamically restoring an attack chain in threat analysis according to claim 3, wherein: The construction and optimization of the Bayesian network model includes: Determine the attack step nodes based on historical data and known attack patterns; Based on historical data, calculate the prior probability of each attack step occurring; Mapping multi-source evidence data as observation variables into a directed acyclic graph to construct a Bayesian network model; Improve the Bayesian network model through time series variables and dynamically update the posterior probability; Use the time decay factor and sliding window mechanism to dynamically adjust the weight of evidence, conduct correlation analysis on the evidence, and obtain key evidence nodes.

5. The method for dynamically restoring an attack chain in threat analysis according to claim 4, wherein: The use of a visualization engine to generate an attack path diagram includes: The attack steps are represented as nodes, and the directed edges between nodes represent the logical order of the attack; Mark key evidence nodes; The posterior probability is labeled as the confidence.

6. The method for dynamically restoring an attack chain in threat analysis according to claim 5, characterized in that: The verification of the attack chain includes: Define the number of simulations; Based on the obtained prior probability and the real-time updated posterior probability, each attack step in the attack chain is randomly sampled to simulate the attack process; Based on random sampling to simulate the attack process, the frequency of different attack chain development scenarios is counted; If the attack steps and evidence appearing in the simulation match the corresponding steps and evidence in the actual constructed attack chain, the attack chain restoration process ends.

7. The method for dynamically restoring an attack chain in threat analysis according to claim 6, wherein: The dynamically updated posterior probability is expressed as: Among them, S j Indicates the target attack step currently being evaluated, S k represents the kth step among all possible attack steps, T represents the time series variable, P(S j |T) represents the target attack step S given the time series T. j Probability of occurrence, P(E|S j ) indicates that in the target attack step S j The probability of evidence E appearing in the event of Represents all possible attack steps S k To sum, P(E|S k ) represents the number of possible attack steps S k The probability of observing evidence E when the occurrence of k |T) represents all possible attack steps S given the time series variable T. k Prior probability of occurrence.

8. A system for dynamically restoring attack chains in threat analysis, applying the method according to any one of claims 1 to 7, characterized in that: include: An acquisition module, used to acquire multi-source evidence data; An evidence solidification module, configured to process the acquired data by combining the first solidification technology with the second solidification technology, generate a timestamp-based hash chain, and calculate a root hash value; Evidence signature module, used to digitally sign the hash chain based on the processed data using asymmetric encryption technology; The Bayesian network analysis module is used to build and improve the Bayesian network model based on the digitally signed hash chain, and obtain key evidence nodes by integrating time factors and dynamic weights; The visualization and verification module is used to generate an attack path diagram based on key evidence nodes using a visualization engine and verify the attack chain, thereby achieving accurate restoration of the attack chain and locating key evidence.

9. An electronic device, characterized in that: include: Memory, used to store programs; A processor, configured to load the program to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images